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1.0  Technical  Discussion 

1.1  Introduction 

The  effort  in  April  1963*  vas  in  the  areas  of: 

1.  Performance  Valuation  Procedure,  and 

2.  Reliability  Design  for  Computer  Organizations. 

1.2  Performance  Valuation  Procedure 


In  progress  is  the  analysis  of  degraded  mode  errors  in  midcourse 
trajectory  determination. 

The  basic  theory  applied  is  described  in  the  literature  as  a  stable 
computational  method  and  expected  to  be  insensitive  to  round>off  errors.  Di¬ 
rect  application  of  the  theorems  published  would  lead  to  the  conclusion  that 
computation  errors  are  negligible  against  Instrument  anomalies.  Considerable 
time  vas  spent  to  modify  the  existing  results  by  introducing  computation  noise 
into  the  basic  dynamical  model.  Convergence  of  the  estimation  procedure  and 
equlllbrlvun  vas  found  to  be  significantly  dependent  on  the  computation  methods 
used  and  on  the  accuracy  limitations  in  the  digital  computer. 

Two  error  sources  were  found  to  be  dominant: 

1.  Error  in  the  state  transition  matrix,  and 

2.  Error  in  the  weighting  factor  (optimum  filter). 

The  errors  are  generated  during  integration  and  matrix  inversion. 

In  progress  is  the  statistical  treatment  of  round-off  errors  in 
matrix  inversion.  Worst  case  estimates  are  known,  but  seem  not  useful  in 
real  time  applications.  It  is  desired  to  find  the  variance  rather  than  a 
worst  case  bound  because  of  the  probabilistic  measure  of  performance  degrada¬ 
tion  in  navigation  systems  (ellipsoid  of  concentration). 

The  actual  objective  of  the  performance  measxire  development,  to 
relate  computer  limitations  with  system  performance  in  midcourse  navigation, 
seems  almost  accomplished.  However,  considerable  time  will  be  necessary  to 
complete  and  to  review  the  model  in  all  details  and  to  work  out  numerical 
examples . 
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1.3  Reliability  Design  for  Costputer  Organisations 

A  serial,  general-purpose  aachlne  has  been  analyzed  to  determine 
the  effect  of  self-reorganization  on  machine  reliability  The  purpose 

of  this  analysis  was  to  determine  if  the  gain  from  self-reorganization  tech¬ 
niques  is  positive  or  have  the  components  required  to  implement  the  self- 
reorganization  methods  negated  the  entire  advantage. 

In  this  study  which  is  attached,  the  mean  time  between  catastrophic 
failures  is  2.3  times  the  MTBF  for  an  equivalent  computer  of  standard  organi¬ 
zation.  The  penalty  in  total  machine  size  was  an  Increase  in  component  count 
of  18^.  Since  the  memory  was  excluded,  as  it  was  covered  in  a  previous  re¬ 
port  (SRS-622)  and  the  memory  is  generally  about  half  the  computer,  the  in¬ 
crease  in  size  for  the  entire  computer  is  about  10$. 

1.1*  Follow-On  Effort 


Work  in  the  above  two  areas  will  continue.  In  addition,  work  in 
the  area  of  reliability  programming  will  commence. 

1.5  Action  Items  " 


None. 

2.0  Trips  and  Visits 

On  29  April  1963,  Messrs  T  J  Bums  and  I  Terris  of  Hughes  visited  Capt 
J  N  VanDusen  of  SSD,  and  Mr  J  Y  Miyamoto  of  Aerospace  Corp,  to  discuss  the 
progress  of  the  project. 
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3.3  Assigned  Personnel 

Anton  Holick,  Staff  Engineer 
Ira  Terris,  Project  Engineer 
3.**  Additional  Information 

The  aforementioned  actual  figures  were  recapitulated  from  Hughes 
Aircraft  Company  Tab  Run  dated  28  April  1963. 

3.5  Milestone  Chart 


The  Milestone  Chart  can  be  found  on  the  last  page  of  this  report. 

It  should  be  noted  that  the  estimated  completion  dates  for  Milestones  B  and 
C  have  been  moved  from  the  end  of  May  to  the  end  of  July.  The  moving  of 
Milestone  B  was  necessitated  by  the  nonexistence  of  a  complete  error  analysis 
of  the  effects  of  digital  computer  noise  on  midcourse  guidance.  This  analysis 
presently  is  being  performed.  The  moving  of  Milestone  B  coincides  with  the 
earlier  starting  of  the  effort  for  Milestone  C,  which  was  not  scheduled  to 
start  until  the  end  of  May,  but  is  being  started  at  the  beginning  of  May. 

This  was  necessitated  by  the  intimate  relationship  of  Milestones  B  emd  C 
which  necessitates  that  to  some  extent  they  be  performed  simultaneously. 
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Introduction 

Within  the  quest  for  more  reliable  digital  computers,  it  is  desired  to 
examine  machines  which  possess  higher  reliability  by  virtue  of  their  ability 
to  operate  after  permanent  failures  have  occurred.  This  ability  could  be 
possessed  by  machines  which  have  the  ability  to  properly  evaluate  seemingly 
wrong  results  (by  program  methods),  by  building  machines  with  redundant 
parts,  by  machines  which  have  self-reorganizing  capability,  or  by 
unknovTi  and  unspecified  methods.  As  used  herein,  the  expression  'self¬ 
reorganizing  machines'  denotes  machines  which  have  a  minimum  of  redundancy 
and,  thus,  recover  from  a  failure  by,  wherever  possible,  excluding  failed 
equipments  from  the  paths  of  information  flow  or  replacing  them  with  equip¬ 
ments  which  had  nonessential  roles  in  the  machine's  organization,  rather 
than  replacing  the  failed  equipments  with  redundant  units.^  Thus,  relia¬ 
bility  is  increased  at  a  reduction  or  degradation  of  the  m»^chines  capability 
rather  than  by  pure  redundancy.  \ 

One  can  envision  rather  quickly  how  such  schemes  can  be  implemented. 

The  question  which  arises  and  which  must  be  answered  is,  "After  implementa¬ 
tion  of  these  self-reorganizing  schemes,  do  I  have  a  machine  which  has  a 
longer  mean  time  between  catastrophic  failures  or  has  the  equipment  required 
to  achieve  self-reorganization  negated  the  reliability  gain?" 

Because  there  are  many  factors  which  cannot  be  expressed  in  a  general 
mathematical  form,  it  appears  that  the  only  way  to  euiswer  the  above  ques¬ 
tion  is  by  an  example  of  a  machine  design.  For  this  purpose,  a  rather 
simple  machine  was  chosen  and  designed  in  forms  with  and  without  self¬ 
reorganizing  capability.  This  design  effort  yielded  a  quantitative  .measure 
of  reliability  gain  by  self-reorganization  and  a  feeling  for  the  areas  in 
which  further  work  should  be  performed. 

2.0  Self-Reorganizing  Machines 

To  permit  operation  after  the  occurrence  of  errors  or  failures,  it  is 
necessary  to  be  able  to  detect,  classify  (transient  or  permanent),  and  re¬ 
cover  from  errors.  The  methods  that  one  uses  for  detection,  depend  on  the  { 
time  which  is  allotted  for  error  detection.  (This  time  is  a  variable'  l 
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depending  on  the  error  being  caused  by  the  loss  in  operational  calculation, 
the  error  state  before  this  fail\ire,  etc.)  If,  vhen  a  failure  occures,  the 
allowed  detection  time  is  sufficiently  long,  program  methods  suffice;  while 
if  this  time  is  too  short,  hardware  must  be  included  in  the  machine  to  per¬ 
form  the  error  detection  function.  Since  determination  of  the  method  of 
error  detection  is  based  on  the  use  of  the  machine,  it  is  considered  beyond 
the  scope  of  this  memorandum. 

^ After  detection,  it  is  necessary  to  classify  the  error  as  a  transient 
or  permanent  failure.  Since  there  is  a  time  dependence  in  the  former  case, 
the  obvious  method  of  classification  and  recovery  if  the  fault  was  a  tran¬ 
sient  is  recomputation.  Of  course,  as  in  the  case  of  a  lost  accelerometer 
input,  recomputation  is  not  always  possible.  In  these  eases,  the  time 
variation  may  be  used  for  classification  (for  example,  see  what  happens 
when  next  input  occurs),  but,  recovery  must  be  effected  by  other  procedures. 

If,  however,  the  error  is  due  to  a  permanent  failure,  it  is  necessary 
to  localize  the  failure  and  remove  the  failed  equipment  from  the  path  of 
information  flow.  The  problem  of  failure  localization  for  the  self-organ¬ 
izing  machine  discussed  herein  should  not  be  very  different  from  the  usual 
machine.  However,  rather  than  enter  a  discussion  of  the  localization  meth¬ 
ods  for  self-reorganizing  machines  at  this  time,  it  is  deemed  better  to 
study  self-reorganizing  techniques  and  obtain  an  estimate  of  their  effect  > 
on  machine  reliability. 

3.0  Self-Reorganization  Techniques 

Machines  which  have  only  one  organization  have  that  organization  spec¬ 
ified  by  the  wiring  of  the  machine.  If  the  organization  of  the  machine  may 
be  specified  by  the  program,  the  machine  is  considered  self-reorganizing 
and  the  manner  in  which  the  reorganizations  are  specified  determines  the 
degree  of  sophistication  of  the  system.  Since  this  study  is  concerned  with 
machines  of  the  present  or  near  future,  we  are  limited  to  rather  unsophis¬ 
ticated  systems. 

Since  the  machine  organization  must  be  continually  specified,  it  is 
necessary  that  the  information  specifying  organization  be  in  an  active 
storage  element  or  flip-flop  register.  This  register  controls  logic  which 
controls  the  transfers  of  Information  from  register-to-reglster,  thereby 
specifying  the  machine's  organisation.  To  change  the  organisation,  it  is 
merely  necessary  to  alter  the  eratents  of  this  register  by  a  commend  (this 
register  lodis  like  a  buffer  register). 
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First,  let  us  consider  the  nunher  of  organization  states  vhich  a  ma» 
chine  may  assume.  It  is  possible  for  a  word-split  memory*  and  its  asso¬ 
ciated  electronics  to  have  as  many  as  28  failure  states  and  have  some 
operable  storage  remaining.  Thus,  including  the  totally  operable  state, 
there  are  29  states  for  the  memory.  If  the  arithmetic  unit  may  be  split, 
there  are  three  states  for  it.  The  control  unit,  with  its  four  to  six 
registers  and  instruction  decoder,  may  have  from  I6  to  6b  states,  and  the 
input-output  unit,  vhich  usually  has  from  5-15  registers,  has  at  least  32 
states.  Thus,  by  multiplying  these  numbers,  it  is  seen  that  the  entire 
computer  may  have  in  the  order  of  50,000  states.  By  proper  design,  it 
may  be  possible  to  limit  the  states  to  1,000.  In  this  case,  the  state 
register  would  have  10  flip-flops  and  be  comparable  in  length,  and  nearly 
equally  prone  to  failure  as  any  half  register.  Thus,  the  state  register 
should  have  a  single  error-correcting  facility  vhich  require^  an  additional 
four  flip-flops.  Nov,  logic  is  needed  to  decode  the  state  register.  With 
a  single  error-detecting  code,  each  state  of  the  computer  is  specified  by 
lb  states  of  the  register.  Using  AND/OR  logic,  ve  require  lb  thirteen  in¬ 
put  AND  gates  and  one  lb  input  OR  gate  or  196  diodes  per  machine  state. 

This  is  an  excessive  number  of  components  andi  leads  to  the  conclusion  that 
the  state  register  should  be  divided.  Thus,  one  or  two  flip-flops  are 
associated  with  each  computer  equipment  block  and,  since  one  or  two  flip- 
flops  are  much  more  reliable  than  a  block  of  equipment,  no  redundancy  of 
the  flip-flops  is  required.  -  — 


To  further  Justify  the  last  statement,  it  is  noticed  that  a  failure 
of  the  state  flip-flop  ceui  cause  total  system  failure  if,  on  failure,  it 
enters  the  state  used  when  there  is  no  failure  in  its  associated  equip¬ 
ment  and,  indeed,  there  is  a  failure  in  the  associated  equipment.  But, 
this  requires  two  failures  and  is  much  less  probable.  The  only  single 
failures  of  the  state  indicating  equipment  which  causes  total  failure  are 
where  both  outputs  are  low  indicating  to  the  logic  to  use  neither  the 
original  equipment  nor  its  replacement,  or  where  both  outputs  are  high 
indicating  use  of  two  equipments  for  one  function. 

To  obtain  a  quantitative  knowledge  of  the  situation,  consider  a  12- 
f lip-flop  register  and  its  state  flip-flop.  Let  p  be  the  probability  of 
one  flip-flop  operating  correctly.  The  probability  of  correct  operation 
is  p*^.  The  probability  of  failure  of  the  state  flip-flop  is  q,  which  is 
much  less  than  unity.  The  probability  of  two  failures,  one  of  which  is 
the  state  flip-flop,  is  12qp*^q  ■  12q^  «  q.  Thus,  very  little  is  gained 
by  using  redundancy  of  the  state  flip-flop. 


*A  Holiek,  "Word  Split  Technique  as  a  Means  to  Increase  the  Failure 
Tolerance  Level  in  Core  Memories, "  Hughes  Aircraft  Co,  Report  No 
8R8-622,  15  February  I963. 
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As  suspected,  certain  machine  org^plsations  are  more  amenable  to  self* 
reorganisation  than  others,  and  self-reorganisation  techniques  used  vary 
with  the  machine  block. 


The  two  self-reorganisation  procedures  which  are  used  in  this  paper 


(1)  Exclusion  of  failed  portions  frco  the  path  of  information 

flow,  and 

(2)  Replacement  of  the  failed  part. 

The  component a  in  a  machine  are  used  either  in  logic  or  storage  de¬ 
vices.  Generally  speaking,  the  logic  is  of  a  nonrepetitive  nature,  while 
the  storage  has  a  repetitive  structure.  Further,  the  ratio  of  components 
to  input  and  output  signals  is  higher  for  storage  than  for  logic.  Thus, 
it  appears  that  the  application  of  self-reorganisation  techniques  to  stor¬ 
age  devices  is  more  prof itable* than  to  logic. 


Elimination  of  Registers 


First,  let  us  examine  the  problem  of  removing  a  register  from  the  I 
machine  organization.  From  the  logic  viewpoint,  the  register  is  a  holding  -I 
element  and  it  only  affects  its  outputs  as  it  is  a  unilateral  element. 

Thus,  register  removal  is  accomplished  by  setting  the  outputs  to  a  logic 
state  which  permits  proper  operation  of  the  remainder  of  the  machine.  Since 
information  flow  is  unidirectional,  the  inputs  to  the  register  are  unaffected 
by  the  failed  register,  and  nothing  need  be  done  on  the  input  side  from  a 
logic  viewpoint.  (From  a  circuit  viewpoint,  this  may  not  be  true,  but  we 
shall  not  undertake  a  failure  mode  analysis  at  this  time.)  However,  it  may 
be  desirable  to  prevent  these  inputs  from  being  lost.  In  that  case,  the 
Inputs  must  be  routed  to  an  alternate  register.  This  reorganization  (elim¬ 
ination  of  a  register)  is  accomplished  thru  the  logic  associated  with  the 
state  flip-flop  of  that  register. 


For  an  example  of  the  above,  let  us  consider  a  failure  in  the 
least  significant  half  of  the  accumulator  register  and  assume  that  this  fail- 
use  shall  be  eliminated  by  dropping  the  least  significant  half  of  the  regis¬ 
ter.  If  this  accumulator  is  in  a  parallel  arithmetic  unit,  one  can  prevent 
the  least  significant  half  of  the  accumulator  from  affecting  the  most  signif¬ 
icant  half  by  elisiinating  the  least  significant  half  from  the  shift  chain, 
bringing  the  initial  carry  into  the  least  significant  bit  of  the  most  sig¬ 
nificant  half  in  the  adder,  breaking  the  carry  chain  in  the  adder,  causing 
conditional  Jump  gates  to  Usregard  the  least  significant  half,  and  reduc¬ 
ing  the  number  of  cycles  in  multiply  and  divide  by  a  factor  of  two.  It 
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should  be  noticed  that  it  is  not  necessary  to  cause  the  register  output 
for  the  least  significant  half  to  be  set  to  zero  as  the  Junk  in  this  half 
register  is  no  better  nor  worse  than  zero,  or  to  disable  the  adder  output 
to  the  least  significant  half.  The  above  can  be  accomplished  with  seven 
gates  (two  for  shifting,  one  for  initial  carry,  one  for  the  conditional 
Jump  gates,  one  to  break  the  carry  chain,  and  two  to  alter  the  cycle 
counter) . 


If  the  arithmetic  unit  is  aerial  rather  than  parallel,  the  least 
significant  half  of  the  accumulator  la  dropped  in  an  analogous  manner.  In 
this  case,  only  six  elements  are  needed  to  alter  the  cycle  and  bit  coxmters 
and  to  get  the  register  output  from  the ‘most  significant  half. 

The  problem  of  eliminating  the  most  significant  half  and  using 
the  least  significant  half  for  the  most  significant  half  is  slightly  more 
complicated  for  a  parallel  organization  but  identical  to  the  above  for  a 
serial  organization.  The  only  difference  in  the  parallel  case  is  the 
enabling  of  the  logic  to  permit  the  most  significant  bit  of  the  least  sig» 
nif leant  half  to  be  a  sign  bit. 

3.2  Replacement  of  Registers 

There  exist  in  a  machine  certain  registers  which,  by  present 
thinking,  are  essential  to  the  operation  of  a  digital  computer.  However, 
by  some  future  technique,  it  may  be  possible  to  accept  failures  in. these 
registers  or  to  eliminate  these  registers  in  part  or  whole  from  the  struc¬ 
ture  and  continue  to  operate  successfully.  Examples  of  registers  of  this 
type  are  the  memory  address  register  and  the  instruction  register.  These 
registers  are  generally  not  merely  delays,  but  inputs  to  a  decoder,  and, 
as  such,  their  content  is  operated  upon  in  parallel.  Thus,  replMement 
of  these  registers  requires  gates  at  the  output  of  each  flip-flop  (assum¬ 
ing  serial  input  to  the  register). 

It  should  be  noticed  that  there  exists  a  restriction  in  register 
replacement  which  results  from  the  use  of  different  types  of  registers  in 
the  computer.  These  register  types  are: 

(1)  Shift-in  -  shift-out  with  no  provision  for  parallel  read¬ 
out}  l.e.,  core-shift  registers, 

(2)  Coxmters,  and 

(3)  General  flip-flop  registers  (serial  and  parallel  capability 
for  both  inputs  sad  outputs). 
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Types  2  and  3  suffice  for  a  computer,  but  vhere  Type  1  can  be 
used,  they  are  more  economical.  The  restrictions  on  register  replacement 
are  Type  1  can  be  replaced  by  either  Types  1  or  3,  and  Types  2  and  3  can 
be  replaced  by  only  Types  2  and  3,  respectively. 

3.3  Evaluation  of  Self-Reorganization  Techniques 

As  mentioned  in  Section  1.0,  it  is  desired  to  obtain  a  (luantita* 
tive  measure  of  the  effect  of  self-reorganization  techniques  on  machine 
reliability.  Although  this  measure  vill  not  be  an  upper  bound  on  the  use¬ 
fulness  of  these  techniques,  the  measure  vill  indicate  if  these  techniques 
indeed  do  improve  the  reliability,  or  whether  the  gain  is  offset  by  the 
components  needed  to  implement  the  techniques,  vhere  further  improvement 
is  most  likely  to  be  achieved,  and  vhere  further  improvement  is  needed. 

Since  a  measure  of  the  reliability  improvement  is  best  achieved 
by  doing  a  design  (as  ve  need  component  counts),  ve  do  that  in  the  follow¬ 
ing  section. 

1».0  Self-Reorganizing  Computer  for  Inertial  Guidance  System 

The  computer  which  is  used  in  this  example  is  shown  in  its  standard 
(not  self-reorganizing)  form  in  Figure  1.  This  computer  accepts  accelera¬ 
tion  and  time  pulses,  and  outputs  command  signals  and  gyro  torquing  pulses. 

U.l  Standard  Computer 

The  following  machine  organization  is  assumed: 

(1)  Random  access  core  memory  of  4,096  words  with  parallel 
readout  and  4  microsecond  cycle  time. 

(2)  Serial  arithmetic  unit  operating  at  a  2  megacycle  per  sec¬ 
ond  rate. 

(3)  True  (two's)  ccmplement  arithmetic. 

(4)  Orders  are  13  bits  long  (2  orders /word ) . 

(3)  Numbers  are  30  bits  long. 

(6)  One  index  register. 

(7)  Integrated  circuits  are  used  wherever  j^ssiblc* 

(8)  Basle  clock  rate  is  2  me. 
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Further  details,  such  as  Instruction  rep’ertoire  and  order  code  are  given 
in  the  appendix. 


lj.1.1  Control  Unit 


The  control  unit  is  rather  standard  in  construction  and, 
therefore,  covered  very  briefly. 

The  instruction  register  is  7  flip-flops  and  accepts  in¬ 
formation  in  a  serial  manner  for  decoding  by  the  instruction  decoder. 

The  index  register  holdk  a  6-bit  number  (0-63)  for  adding 
to  the  operand  address  when  desired. 

The  program  counter  (12FF}  holds  the  address  of  th‘e  next 

instruction. 


The  shift  counter  (5FF)  is  used  during  shift,  multiply, 
and  divide  operation. 

The  timing  counter  (8FF)  counts  bit  times  and  word  times 
on  short  instructions  and  during  instruction  access. 

''  J. 

I*. 1.2  Arithmetic  Unit 


This  unit  has  a  serial  adder.  The  memory  register  is 
used  as  the  third  register. 

U.1.3  Memory 

The  memory  is  a  standard  random  access  magnetic  core  mem¬ 
ory  of  U,092  30-bit  words. 

l».l.h  Input-Output  Unit 

This  unit  has  two  accumulators,  one  for  accelerometer  and 
time  pulses  and  the  other  for  gyro  torquing  pulses.  Each  accumulator  con¬ 
sists  of  a  30  flip-flop  shift  register  and  an  adder.  The  pulse  inputs  are 
assumed  synchronized  to  the  computer  by  providing  the  platform  coupler  with 
the  necessary  timing  signals. 

A  6  flip-flop  gyro  torque  control  register  tells  the  plat¬ 
form  coupler  which  torque  directions  are  required  for  the  three  axes. 

The  buffer  register  has  a  serial  input  and  output  for  oper¬ 
ation  with  other  equipsMnts  and  displays. 
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4.2  Self-Reorganizing  Computer 


The  aelf-reorgaolzing  computer  with  the  eaae  capability  aa  the 
standard  computer,  is  shovn  in  block  diagram  fora  in  Figure  2.  The  fea¬ 
tures  1-8  listed  for  the  standard  computer  hold  for  the  self-reorganizing 
computer.  The  self-reorganizing  capabilities  proposed  for  this  example 
are  discussed  below.  The  capabilities  described  are  not  to  be  construed 
as  the  best,  but  only  indicative  of  what  can  be  accomplished. 


4.2.1  Control  Unit 


The  control  unit  contains  equipment  which  is  generally 
essential  to  the  operation  of  the  machine  and  with  present  techniques  no 
failures  can  be  tolerated.  Thus,  these  equipments  must  be  replaced  in 
case  of  failure.  For  this  purpose,  it  is  assumed  that  there  is  a  separate 
spare  counter  which  may  replace  any  of  the  other  counters  in  the  control 
unit.  Here,  a  spare  is  required  as  no  nonessential  counter  exists.  The 
three  registers,  memory  address,  instruction,  and  index,  are  the  same  type 
as  in  the  arithmetic  unit,  and  it  is  assumed  that  one  of  the  four  arith¬ 
metic  unit  half  registers  may  replace  these  registers.  The  details  of  re¬ 
placement  are  wired  into  the  logic.  Allowance  is  made  for  operation  with 
failure  iii  any  one  half  register. 

The  instruction  decoder  is  logic  and  following  the  dis¬ 
cussion  of  Section  3.0,  is  left  as  an  essential  equipment. 

4.2.2  Arithmetic  Unit 

The  arithmetic  unit  is  serial  with  provision  for  splitting 
in  half.  When  the  arithmetic  unit  is  split,  the  bit  counter  input  is 
shifted  left  one  bit  as  the  word  length  is  cut  in  half.  Also,  if  the  least 
significant  half  is  used,  the  new  sign  flip-flop  must  have  some  logic 
activated.  The  serial  adder  is  assumed  nonredvmdant  for  this  first  pass. 
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This  unit  has  accumulators  for  accelerometer  pulses,  gyro  I . 

torquing  pulses,  and  time.  As  discussed  in  Section  4.1.4,  there  are  two  j 

shift  registers,  each  with  an  adder.  If  a  failure  in  one  of  these  units  ■  |. 

occurs,  the  other  assumes  the  entire  load  by  shortening  the  storage  capac- 
ity  for  each  quantity.  Of  course,  this  means  that  the  computer  is  required  |.. 

to  do  more  input-output  processing  and  may  be  required  to  drop  some  of  its  I-  . 

nraessential  functions.  j.. . 

The  gyre  torque  control  register  is  replaced  by  the  buffer  [ 

register  on  failure.  The  buffer  register,  which  at  time  is  used  infrequently, 
is  replaced  by  one  of  the  arithmetic  unit  half  registers.  1. 
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1».2,U  Memory 

The  memory  utilizing  the  word  aplit  technique  is  discussed 
in  detail  in  the  previously  referenced  report  and,  therefore,  is  not  dis¬ 
cussed  in  this  report. 

U,3  Computer  Reliability 

In  the  above  computer  organization,  a  computer  whose  only  essen¬ 
tial  parts  are  the  serial  adder  in  the  arithmetic  unit,  the  instruction  de¬ 
coder  in  the  control  unit,  the  information  transfer  gates  is  shown,  and  the 
self-reorganizing  elements.  It  remains 'to  determine  the  reliability  of 
this  computer  in  order  to  obtain  a  quantitative  measure  of  the  reliability 
gain.  For  this  purpose,  it  was  necessary  to  do  detailed  logic  designs  on  a 
machine  without  reorganization  capability  and  one  of  the  same  computational 
capability,  but  with  the  above  self-reorganizing  capability.  For  the  details 
of  these  designs,  the  reader  is  referred  to  the  Appendix. 

From  the  Appendix,  it  is  seen  that  the  original  machine  has  771 
Micrologic  elements  excluding  memory  cores,  decoding  electronics,  and  sense 
electronics.  Vhen  the  self-reorganizing  capability  is  added,  the  resulting 
essential  equipment  is  the  adder,  logic,  and  reorganising  logic  which  total  | 
337  elements. 

For  small  probability  of  failure  and  assuming  that  all  the  Micro¬ 
logic  elements  have  an  equal  probability  of  failure,  the  probability  of 
catastrophic  failure  Pf  ■  Rf^t.  Also,  this  assumes  that  only  failures  in 
essential  equipment  contribute  significantly  to  the  probability  of  failure. 

To  a  first  approximation,  this  assumption  is  Justified  as  a  catastrophic 
failure  from  nonessential  equipment  requires  at  least  two  failures.  Thus, 
we  see  that  the  improvement  in  MTBF  is  given  by  the  ratio  of  essential  com¬ 
ponents  in  the  original  machine  to  the  self-reorganizing  machine. 

Thus,  in  the  first  cut  presented  herein,  we  have  achieved  an  im- 
provmnent  in  MTBF  of  2.3  (H^  *  2.3). 

337 

5.0  Conclusions 


On  this  first  cut  at  an  application,  it  has  been  shown  that  the  MTBF 
of  a  guidance  computer  (excluding  mestory)  can  be  improved  by  a  factor  of 
2.3.  (The  improving  of  MTBF  in  the  memory  has  been  investigated  in  the 
previously  referenced  report,  sod  even  greater  improvements  have  been  made 
in  that  area.) 

The  example  shown  in  this  memo  deawnstrates  that  a  simple  self-reor- 
gsnising  system  has  a  higher  MTBF  than  its  stsodsrd  counterpart  (the  gains 
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are  not  cancelled  by  the  added  components) ,  and  shows  that  work  along  these 
lines  should  be  continued.  Although  the  computer  presented  is  rather  limited 
in  capability,  the  MTBF  improvement  is  a  ratio  which  will  be  fairly  inde¬ 
pendent  of  machine  size. 

At  this  time,  it  should  be  emphasized  that  the  eliminating  or  dropping 
of  registers  from  a  machine's  organization  results  in  a  loss  in  computa¬ 
tional  capability.  This  loss  results  in  less  accurate  computations,  if  one 
chooses  to  use  the  half  length  operands,  at  no  loss  in  time,  or  a  much 
slower  machine  if  one  requires  double  precision  arithmetic  performed  by 
subroutine  to  compensate  for  the  half  length  arithmetic  unit.  Mr  A  Hollck 
is  studying  the  errors  due  to  degraded  mode  operation  (half-length  operands) 
on  midcourse  guidance  trajectory  determination. 

6.0  Future  Work 

Herein  have  been  shown  the  application  of  two  self-reorganization  tech¬ 
niques,  and  from  the  design  presented,  one  obtains  the  feeling  that  with 
these  techniques  an  upperbound  on  MTBF  improvement  is  about  UooiK. 

The  future  work  should  Investigate  the  finding  of  other  techniques  and 
the  detailed  application  of  these  techniques  to  various  machine  organize-  j 
tlons  (parallel  as  well  as  sericd  machines). 

In  particular,  future  studies  should  Include; 

(1)  Order  codes  which  result  in  higher  machine  reliability. 

(2)  Program  compensation  of  failed  machines  (methods  for  toler¬ 
ating  failures  which  cause  a  suichine  to  perform  orders  in  a  slightly  incor¬ 
rect  swnner,  or  doing  failed  orders  by  subroutine). 

(3)  Study  of  input-output  equipment  with  interrupt  features  and 
its  effect  on  self-reorganizing  machines. 
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Presented  herein  are  the  details  for  the  standard  and  self-reorganlz> 
Ing  machines.  These  details  are  needed  so  that  an  accurate  reliability 
estimate  In  which  one  could  display  confidence  could  he  obtained.  It  should 
be  emphasized  that,  while  complete  accuracy  In  component  counts  wotild  be 
best,  for  the  purposes  of  this  paper,  only  relative  numbers  are  required. 
Thus,  any  omissions  will  probably  be  common  to  the  two  machines  and  the 
effect  will  be  reduced.  Further,  a  failure  mode  analysis  Is  required  to 
obtain  a  true  reliability  figure,  particularly  In  the  self-reorganizing 
equipment  where  only  certain  failures  are  catastrophic. 

The  general  features  of  the  machine  are  discussed  In  Section  b.l.  In 
addition,  there  Is  a  group  select  feature  for  memory  addressing  which  per¬ 
mits  Instructions  to  be  only  15  bits  long.  The  memory  Is  divided  Into  I6 
groups  of  236  words  each.  On  "arithmetic"  %ype  Instructions  which  have 
only  an  8-blt  address,  the  group  Is  specified  by  the  group  from  which  the 
order  was  taken  If  the  group  select  bit  Is  1;  if  It  is  0,  the  group  select 
for  the  operand  Is  0000. 

Instruction  Repertoire 

There  are  three  classes  of  instructions  which  are  described  In  detail 
below. 

The  Jump  Instructions  contain  a  full  12-blt  address  which  is  not  alter¬ 
able  by  group  select  or  Indexing.  On  Jump,  the  program  counter  is  put  In 
the  memory  at  location  0000  for  a  return  Jump.  Jumps  are  always  to  instruc¬ 
tions  In  the  left  half  of  a  word. 

The  arithmetic  Instructions  have  an  8-bit  address  which  Is  indexable. 
The  four  most  significant  bits  are  specified  by  a  group  select  feature.  If 
the  group  select  bit  (bit  6)  is  zero,  the  group  select  for  the  operand  Is 
zero.  If  bit  6  Is  one,  then  the  group  from  which  the  instruction  was  ob¬ 
tained  is  used.  The  Index  register's  contents  are  added  to  the  addreis  on 
bit  7  equal  to  one.  The  Index  register  holds  a  6-bit  number  whose  magnitude 
is  in  the  range  0-63. 

The  third  class  of  instructions  does  not  require  a  memory  cycle  for 
their  execution. 

The  iastruction  repertoire  fellows  on  the  next  page. 
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UCJ  -  Unconditional  Jxuip. 

JLZ  ••  Jump  on  eontenta  of  A  register  less  than  zero. 

JCZ  >  Jump  on  contents  of  A  register  greater  than  zero. 

JOI  -  Jump  on  Indicator.  The  indicator  is  set  on  overflow  or 

cycling  of  index  register  ( see  IXR  instruction) .  The 
indicator  is  reset  on  the  instruction  after  it  is  set. 

CAD  -  Clear  Accumulator  and  Add  contents  of  location  specified 
to  the  contents  of  A  (C(A)). 

ADD  >  Add  contents  of  A  to  contents  of  specified  location  and 
put  result  in  A. 

SUB  -  Subtract  contents  of  specified  location  from  C(A)  and 

put  result  in  A. 

MPY  -  Multiply  C(A)  hy  C  (specified  address),  and  put  result 

in  A  and-Q. 

DIV  -  Divide  A  (A  and  Q)  hy  C  (specified  address)  and  put  re¬ 

sult  in  Q. 

EXT  -  Form  the  logical  product  of  C{A)  and  C  (specified  address) 
and  put  result  in  A. 

STR  -  Store  C(A)  in  specified  address.  C(A)  is  not  disturbed. 

8XR  -  Set  index  register  to  number  specified  by  bits  10-15. 

SRL  -  Shift  left  by  number  of  places  specified  by  bits  11-15. 

Bit  6  specifies  long  or  short  shift. 

SHR  -  Shift  right;  bit  6  specifies  long  or  short. 

ZFT  -  Input  operation  which  transfers  cmtents  of  specified 

interface  register  (bits  10-15)  to  A  register  (30  bits)^ 

OFT  •>  Transfers  contents  of  A  to  specified  interface  register,^ 

BOS  -  Set  group  ssleet  flip-fl^.  (>»  most  significant  bits  of 

program  counter)  to  number  specified  by  bits  12-15  of 
order. 
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ZXR  -  Increment  the  content  oC  the  Index  remitter  and  set  the 
Indicator  fllp>flop,  if  the  old  content  la  e^ual  to  the 
number  apecified  by  bits  10>15» 

SSR  -  Set  state  register  flip>flop  specified  by  bits  lO-l^t  to 
the  state  specified  by  bit  15*.  (This  instruction  is 
not  implemented  in  the  standard  machine.) 

The  order  code  for  this  instruction  repertoire  is  shovn  in  Table  1, 
attached.  . 


Timing  Sequence 

The  following  indicates  the  machine  seauences  during  the  execution 
and  obtaining  of  the  various  instructions.  W  is  used  to  abbreviate  word, 
and  B  for  bit  time.  The  memory  cycle  is  U  microseconds  or  8  bit  times. 


W1  Bl-BS 

W1  B9-B2lt 

W1  B25«B30 

W2  B1>B30 

W2  B1>B12 
If  STB  operation: 
W2  B13-B16 
W2  B17-W3  BI6 
W3  B17-B20 


Read  and  rewrite  memory  for  instruction  and  incre¬ 
ment  program  counter. 

Transfer  instruction  to  instruction  Register  (bits 
1-7)  and  memory  address  register  (bits  8-15). 

If  I^pe  3  instruction,  transfer  bits  1-6  to  the 
shift  counter. 

Execute  Type  1  and  3  Instructions,  all  of  which  re¬ 
quire  only  one  word  time. 

Do  address  modification  of  Type  2  instructions. 


Read  memory  (clear). 

Transfer  C(A)  to  siemory  register. 
Write  memory. 


If  not  STR  operation: 


W2  B13-B20  Obtain  operand  from  memory. 


*Xote  tkat  tite  register  as  a  whole  cannot  be  treated  as  one  shift  register 
to  save  the  addressing  logic  as  one  failed  flip-flop  which  must  be  toler¬ 
ated  would  not  allow  shifting  thru  it. 
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W3 

W2  B19-B30 
W3  B19-B30 


If  MPy,  put  Bultiplier  in  Q  and  clear  A.  Set  shift 
counter  to  30  on  MPY  or  DIV. 

Execute  until  shift  counter  is  stepped  to  zero  if 
MPY  or  DIV,  or  for  1  word  time. 

If  IVP*  1  or  3  instructions,  transfer  PC  to  MAR. 

If  Type  2  instruction,  transfer  PC  to  MAR. 


Detailed  Block  Diagram  of  Standard  Computer 

• 

A  detailed  block  diagram  of  the  standard  computer  is  shown  in  Figures 
3-6.  Here,  are  shown  the  paths  of  information  flow  and  the  flip«flop  desig¬ 
nations  for  each  register.  Associated  (but  not  shown)  with  each  register  is 
a  gated  clock  pulse  amplifier  for  permitting  information  transfers  at  the 
proper  time.  Putting  the  gating  on  the  clock  pulses  minimises  the  logic. 


Component  Count 

To  obtain  an  exact  component  count,  the  logic  should  be  implemented 
using  the  logic  function  blocks  available  (BOR  or  NAMD  logic).  However,  to 
reduce  the'  labor  considerably,  the  equations  were  written  in  AND-OR  form, 
which  yields  almost  the  same  count  as  HARD  or  NOR  form.  Where  counters  and 
registers  are  used,  the  exact  component  counts  were  obtained  from  the  con¬ 
figurations  given  Fairchild  for  their  Micrologic. 


Registers  and  Counters 

The  following  element  counts  include  two  elements  per  shift  register 
stage,  three  elements  per  shift  register  stage  where  parallel  entry  is  also 
permitted,  three  elements  per  counter  stage,  and  four  eleswnts  per  counter 
stage  where  shift  entry  also  is  required.  The  estimates  also  Include  any 
adders  or  buffer  elements  for  fan-out  or  interface  required. 

Input-Output  Unit  (Figure  3) 


ATR 

T6  elements 

GTR 

76  elements 

CTC 

18  elements 

IN 

60  elements 

it 


10  May  1963 


Memory  Unit  (Figure  U) 


MR  -  90  elements 

Arithmetic  Unit  (Fimre  5) 

AR 

60  elements 

OR 

60  elements 

Control  Unit  (Fl«nire  6) 

MAR 

2h  elements 

IR 

lb  elements 

XR 

12  elements 

B&WC  - 

21  elements 

SC 

.  15  elements 

PC 

36  elements 

Equations  vere  vritten  to  obtain  the  counts  ahovn  below  in  AIIIM)R 
form,  but  cu'e  not  included  in  this  memo.  By  very  simple  transformations, 
these  equations  are  converted  to  NOR  or  NAND  logic.  Then,  using  the  fan¬ 
out  and  fan-in  realizable  for  the  Micrologic  elements,  counts  vere  obtained. 

Decoders 


Instruction  decoder  -  29  elements 

Bit  and  Word-time  decoder  -  3^  elements 

Shift  counter  decoder  -  10  elements 

Information  Gating 

This  gating  is  used  at  the  register  input  or  on  the  clock  pulse 


amplifier. 
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Input-OutPut  Unit 


CTC 

- 

2  elementa 

OTR 

- 

5  eleakenta 

BR 

2  elementa 

Memory  Unit 


Read  Memory  (1/2  cycle) 

- 

2  eleawnta 

Write  Memory  (1/2  cycle) 

m 

1  element 

Read  and  Write 

- 

1$  elementa 

MR 

t 

3  elementa 

Control  Unit 

MAR 

9  elementa 

IR 

3  elementa 

J.. 

XR 

2  elementa 

/ 

B&WC  Reaet 

-  T  elementa 

SC 

4  elementa 

PC 

6  elementa 

Arithmetic  Unit 

Q 

S  elementa 

A 

12  elementa 

Adder  input  1 

- 

S  elementa 

Adder  input  2 

m 

i»  elementa 

Adder  Including  overflov  FF, 
carry  FF,  Add-Sulitract  con¬ 
trol »  aign  correotlone, 

initial  carry,  etc  -  Uo  elementa 


From  the  above,  it  is  determined  that  5.T1  elements  axe  needed  for  registers 
and  200  elements  for  logic  and  gating. 

Self-Reorganizing  Machine 

The  self-reorganizing  machine  has  the  same  basic  structure  as  the 
original  machine,  but  has  the  self-reorganizing  capability  mentioned  in 
the  body  of  this  report. 

This  capability  is  shown  in  detail  in  Figures  7>10.  Using  Micrologic, 
it  is  determined  by  a  count  that  17  flip-flops  and  120  logic  elements  for  a 
total  of  137  elements  are  needed  for  thp  self-reorganizing  capability. 

The  decoding  of  state  register  flip-flops  22  and  23  is  as  follows: 

(22') (23')  -  Full  length  arithmetic 

(22) (23')  -  Use  MSH  registers  only 
(22') (23)  -  Use  LSII  registers  only 


State  register  flip«flops  1  and  2  are  used  for  finding  the  alternate 
register  (ALT)  for  the  control  unit. 

ALT  ■  (Q  LSH)(22)(2')*+  (Q  MSH)(22)(2)  +  (A  LSH)(22)(2)  +  (A  MSH)(23)(l) 


BIT  POSITIOMS 

ORDER  1  2  3  i  6  1  8  2i0111212.ii 

UCJ  000 

JLZ  0  0  1 

JOI  0  1  0 

JPN  0  0  1 

CAD  1  0  0  0  0  GS  XR  * 

ADD  1  0  0  0  1  GS  XR 

SUB  1  0  0  1  1  GS  XR 

MPY  1  0  1  0  1  GS  XR 

DIV  1  0  1  1  1  GS  XR 

ext  1  0  1  0  0  GS  XR 

STR  1  0  0  1  0  GS  XR 

SXR  llOOOlOdd 

SHL  1  1  1  0  0  L/S  d  d  d  d 

SHR  1  1  1  0  1  L/S  d  d  d  d 

IPT  llllOdddd 

OPT  llllldddd 

PCS  llOOOOlddd  d 

IXR  llOOOOOdd 

SSR  llOlddddd 


d  -  don't  ear* 

Blank*  ar*  addrass  bits 
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Menory 


Control  Unit 


FIGURE  1 


Memory 


Control  "Unit 


FIGURE  2 


nOURX  3 


INPUT  -  OUTPUT  UNIT 


PICUBE  7 
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MEMORY  UNIT 
FIGURE  8 
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nCUBE  9 


